Describe Azure architecture and services →mediumMultiple ChoiceObjective-mapped

AZ-900 Describe Azure architecture and services Practice Question

A company runs an e-commerce application on multiple Azure virtual machines in a single region. The IT team needs to distribute incoming web traffic across the VMs, offload SSL/TLS termination to improve VM performance, and route requests based on URL path (for example, /images to one pool of VMs and /api to another). The solution must handle these requirements within a single Azure region. Which Azure service should the company use?

⚠ Common exam trap

A common mix-up: candidates confuse Azure Load Balancer (layer 4) with Application Gateway (layer 7), assuming any load balancer can handle URL path routing and SSL termination, but only Application Gateway provides these application-layer features.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Azure Application Gateway

Azure Application Gateway is a layer 7 load balancer that can distribute incoming web traffic based on URL path, offload SSL/TLS termination to reduce VM CPU overhead, and route requests to different backend pools (e.g., /images and /api) within a single Azure region. It supports HTTP/HTTPS traffic and provides Web Application Firewall (WAF) capabilities, making it the correct choice for this scenario.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Azure Application Gateway
Why this is correct
Correct. Azure Application Gateway is a regional layer 7 load balancer that supports SSL offloading, URL-based routing, and web application firewall capabilities. It is the appropriate service for this single-region scenario with path-based routing requirements.
✗
Azure Traffic Manager
Why it's wrong here
Incorrect. Azure Traffic Manager operates at the DNS level (layer 3/4) and routes traffic based on DNS responses, not by inspecting HTTP/HTTPS URL paths. It also does not perform SSL offloading and is typically used for global traffic distribution across regions.
When this WOULD be correct
A company needs to distribute incoming web traffic across multiple Azure regions for high availability and low latency, and does not require SSL termination or path-based routing. Azure Traffic Manager would be the correct choice for global DNS-based load balancing.
✗
Azure Load Balancer
Why it's wrong here
Incorrect. Azure Load Balancer works at layer 4 (TCP/UDP) and distributes traffic based on IP address and port. It cannot inspect URL paths or offload SSL termination, which are layer 7 functions needed in this scenario.
✗
Azure Front Door
Why it's wrong here
Incorrect. Azure Front Door is a global layer 7 service that can perform URL-based routing and SSL offloading, but it is designed for multi-region deployments and is not the most suitable for a single-region solution. Azure Application Gateway is the recommended service for regional path-based routing.
When this WOULD be correct
A company needs to distribute traffic across multiple Azure regions with automatic failover and SSL offload at the edge, and requires URL path-based routing to different regional backends. Azure Front Door would be correct for a global multi-region application.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

✓Azure Application GatewayCorrect answer▾

Why this is correct

Correct. Azure Application Gateway is a regional layer 7 load balancer that supports SSL offloading, URL-based routing, and web application firewall capabilities. It is the appropriate service for this single-region scenario with path-based routing requirements.

✗Azure Traffic ManagerWrong answer — click to see why▾

Why this is wrong here

Azure Traffic Manager operates at the DNS level and distributes traffic globally across regions, but it cannot perform SSL termination or URL path-based routing within a single region.

★ When this WOULD be the correct answer

A company needs to distribute incoming web traffic across multiple Azure regions for high availability and low latency, and does not require SSL termination or path-based routing. Azure Traffic Manager would be the correct choice for global DNS-based load balancing.

Why candidates choose this

Candidates may confuse Traffic Manager with Application Gateway because both are used for traffic distribution, but Traffic Manager is for global routing, not regional application delivery with advanced features like SSL offloading and URL routing.

✗Azure Front DoorWrong answer — click to see why▾

Why this is wrong here

Azure Front Door operates at the global edge, not within a single region, and does not support URL path-based routing to backend pools within the same region; it is designed for multi-region load balancing and global acceleration.

★ When this WOULD be the correct answer

A company needs to distribute traffic across multiple Azure regions with automatic failover and SSL offload at the edge, and requires URL path-based routing to different regional backends. Azure Front Door would be correct for a global multi-region application.

Why candidates choose this

Candidates may confuse Front Door's global load balancing and SSL offload capabilities with Application Gateway's regional features, or assume that any 'gateway' service can handle regional URL routing.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-900 Describe Azure architecture and services Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question